I originally posted this: https://forums.untangle.com/intrusio...out-alert.html. Basically, every so often IP would stop logging anything until I rebooted my U25x appliance. Then it'd be back to normal for a while, then repeat the cycle.

Now, I'm getting sort of the opposite. I made only one change to my Untangle config: I disabled an inbound port forward on HTTP which was the only inbound forward. When the port was open, and since I have IP set to process after other rules, I would normally get a few IP alerts/blocks a day and only on the open port. As expected, after disabling the inbound port forward, I was getting no alerts/blocks a day. Then suddenly, I'll start getting hundreds or thousands of alerts a day, on all ports. That continues until I reboot the U25x. Then it goes back to normal (now no reports) until it suddenly goes to all again.